CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?
⚠ Common exam trap
It's easy for candidates to confuse the -f flag with the -D (decoy) flag, thinking both are used for evasion, but -f specifically targets packet fragmentation to bypass IDS, while -D hides the source IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-f
The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-D
Why it's wrong here
The -D (decoy) flag in Nmap is used to perform a decoy scan, which involves sending packets from multiple spoofed IP addresses in addition to the real scanning machine's IP. This technique aims to make it more difficult for intrusion detection systems (IDS) or firewalls to identify the actual source of the scan by cluttering their logs with irrelevant entries. While it aids in evasion by obfuscating the scanner's origin, it does not involve fragmenting individual packets to bypass network filters based on packet size or header inspection.
- ✗
-g
Why it's wrong here
The -g (or --source-port) flag allows an attacker to specify a custom source port for Nmap's outgoing probes. This can be useful for evading simple firewall rules that only permit traffic from specific, common ports (e.g., 53 for DNS, 80 for HTTP, 443 for HTTPS), making the scan appear as legitimate application traffic. However, this flag manipulates the source port number in the packet header and has no direct effect on fragmenting the packet's data payload across multiple smaller IP packets.
- ✗
-sS
Why it's wrong here
The -sS flag initiates a SYN scan, also known as a half-open scan, which is the default and often most effective scan type for Nmap. It works by sending a SYN packet and waiting for a SYN/ACK response, indicating an open port, without completing the full three-way TCP handshake. This method is stealthier than a full TCP connect scan as it avoids creating full connections on the target, but it operates at the TCP handshake level and does not involve breaking down IP packets into smaller fragments.
- ✓
-f
Why this is correct
The -f (or --fragment) flag instructs Nmap to fragment the IP packets it sends into several smaller pieces. This technique is specifically designed to evade simple packet filters and intrusion detection systems (IDS) that might inspect only the first fragment of a packet or have difficulty reassembling fragmented packets correctly. By splitting the TCP or UDP header across multiple fragments, it can bypass rules that look for specific header information in a single, complete packet, thus aiding in stealth.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.